Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ae4100252450220b4f7d39214d4660894ee149d9c96a885f844f0652283198e9.bat
-
Size
275KB
-
Sample
240823-czbkratbjl
-
MD5
536ac91b5fe6a53fd85f5d7b609dc591
-
SHA1
5fb565c1bec3e386642e921c34ea365fbcb07127
-
SHA256
ae4100252450220b4f7d39214d4660894ee149d9c96a885f844f0652283198e9
-
SHA512
b47aeba5a1abdcd8b1b6ba67663fb199fca22a21c1417aa830d042268f6c810b9abf246b964d7dc76497b009f8d54e77c1b0f38e5c775097b9fa15dbd19b748f
-
SSDEEP
6144:h1E5NlqQRcu+pHfFQS7w1bUyntarmxcGqKxH1279F:h1E5qz9H9T7w1bUotqgRH+
Static task
static1
Behavioral task
behavioral1
Sample
ae4100252450220b4f7d39214d4660894ee149d9c96a885f844f0652283198e9.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ae4100252450220b4f7d39214d4660894ee149d9c96a885f844f0652283198e9.bat
Resource
win10v2004-20240802-en
Malware Config
Extracted
xworm
5.0
95.98.144.201:2404
JnG5DxKNjDpRvsxT
-
Install_directory
%Temp%
-
install_file
e45iasd.exe
-
telegram
https://api.telegram.org/bot6421494903:AAFuoWigwh2-oDYMZFAWqzFsbHJABidzW1Q
Targets
-
-
Target
ae4100252450220b4f7d39214d4660894ee149d9c96a885f844f0652283198e9.bat
-
Size
275KB
-
MD5
536ac91b5fe6a53fd85f5d7b609dc591
-
SHA1
5fb565c1bec3e386642e921c34ea365fbcb07127
-
SHA256
ae4100252450220b4f7d39214d4660894ee149d9c96a885f844f0652283198e9
-
SHA512
b47aeba5a1abdcd8b1b6ba67663fb199fca22a21c1417aa830d042268f6c810b9abf246b964d7dc76497b009f8d54e77c1b0f38e5c775097b9fa15dbd19b748f
-
SSDEEP
6144:h1E5NlqQRcu+pHfFQS7w1bUyntarmxcGqKxH1279F:h1E5qz9H9T7w1bUotqgRH+
Score10/10-
Detect Xworm Payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1